AWS logo
Amazon QDetector Library

TypeScript detectors

Showing all detectors for the TypeScript language.

Browse by tags
Browse all detectors by tags.
Click here →
Browse by severity
Browse all detectors by severity.
Click here →
Browse by category
Browse all detectors by category.
Click here →

Browse all detectors

Integer overflow

An integer overflow might cause security issues when it is used for resource management or execution control.

AWS insecure transmission CDK

The product transmits sensitive or security-critical data in cleartext in a communication channel that can be sniffed by unauthorized actors.

Insecure cookie

Insecure cookies can lead to unencrypted transmission of sensitive data.

AWS credentials logged

Logging unencrypted AWS credentials can expose them to an attacker.

SQL injection

The use of untrusted inputs in a SQL database query can enable attackers to read, modify, or delete sensitive data in the database.

Insecure connection using unencrypted protocol

Connections that use insecure protocols transmit data in cleartext, which can leak sensitive information.

New function detected

Use of new Function() can be dangerous if used to evaluate dynamic content.

Batch request with unchecked failures

Unchecked failures can lead to data loss.

Unvalidated expansion of archive files

Expanding unverified archive files without controlling the size of the expanded data can lead to zip bomb attacks.

Missing pagination

Missing pagination on a paginated call can lead to inaccurate results.

XPath injection

Potentially unsanitized user input in XPath queries can allow an attacker to control the query in unwanted or insecure ways.

Logging of sensitive information

The logging of sensitive information can expose the information to potential attackers.

Override of reserved variable names in a Lambda function

Overriding environment variables that are reserved by AWS Lambda might lead to unexpected behavior.

Insecure CORS policy

Cross-origin resource sharing policies that are too permissive could lead to security vulnerabilities.

Improper input validation

Improper input validation can enable attacks and lead to unwanted behavior.

Hardcoded credentials

Hardcoded credentials can be intercepted by malicious actors.

Invoke super appropriately

The incorrect use of super() causes problems.

Numeric truncation error

Truncation errors occur when a primitive is cast to a primitive of a smaller size and data is lost in the conversion.

Avoid nan in comparison

Checks if nan is used is comparison.

Missing check on method output

Missing checks might cause silent failures that are harder to debug.

Insufficiently protected credentials

An object attribute constructed from a user-provided input should not be passed directly to a method.

Improper restriction of rendered UI layers or frames

The application incorrectly restricts frame objects or UI layers that belong to another application or domain.

Pseudorandom number generators

Using pseudorandom number generators (PRNGs) is security-sensitive.

AWS missing encryption CDK

The AWS resource is missing appropriate encryption.

Catch and swallow exception

Swallowing exceptions, without rethrowing or logging them, can make it hard to understand why your application is failing.

Header injection

Constructing HTTP response headers from user-controlled data is unsafe.

Use {} instead of new Object()

New Object() has been used for object creation instead of {}.

Hardcoded IP address

Hardcoding an IP address can cause security problems.

Untrusted Amazon Machine Images

Improper filtering of Amazon Machine Images (AMIs) can result in loading an untrusted image, which is a potential security vulnerability.

Weak obfuscation of web requests

Weak obfuscation of web requests makes your application vulnerable.

File Race Bad

File name should not be used to do the file operations.

Improper certificate validation

Lack of validation of a security certificate can lead to host impersonation and sensitive data leaks.

Sendfile injection

The software allows user input to control or influence paths or file names that are used in file system operations.

Cryptographic key generator

Insufficient key sizes can lead to brute force attacks.

improper input validation cdk

Improper input validation can enable attacks and lead to unwanted behavior.

XML external entity

Objects that parse or handle XML can lead to XML external entity (XXE) attacks when they are misconfigured.

Timing attack

Insecure string comparison can lead to a timing-attack.

Missing Amazon S3 bucket owner condition

Not setting the Amazon S3 bucket owner condition could lead to accidentally using the wrong bucket.

Insecure hashing

Obsolete, broken, or weak hashing algorithms can lead to security vulnerabilities.

Session fixation

Session fixation might allow an attacker to steal authenticated session IDs.

Use of Default Credentials CDK

The product relies on default credentials(including passwords and cryptographic keys) for potentially vital functions.

File injection

Writing unsanitized user data to a file is unsafe.

Improper Restriction of Operations within the Bounds of a Memory Buffer

An improper buffer read operation might lead to a BufferOverflowException.

Limit request length

Significant content length can lead to denial of service.

Log injection

Using untrusted inputs in a log statement can enable attackers to break the log's format, forge log entries, and bypass log monitors.

Type confusion

Type confusion occurs when an application accesses a resource using a type that is incompatible with its original type.

Server side request forgery

Insufficient sanitization of potentially untrusted URLs on the server side can allow server requests to unwanted destinations.

aws kmskey encryption cdk

Using an AWS KMS key helps follow the standard security advice of granting least privilege to objects generated by the project.

Inefficient polling of AWS resource

Custom polling can be inefficient and prone to error. Consider using AWS waiters instead.

Avoid Undefined As Variable Name

Checks if the undefined is used as variable.

Index of method comparison

indexOf method should not be compared with values greater than zero.

String passed to setInterval or setTimeout

String passed to setInterval or setTimeout can cause the JavaScript engine to evaluate, which can lead to a security risk.

Data loss in a batch request

A batch request that doesn't check for failed items can lead to loss of data.

Tainted input for Docker API

Passing an unsanitized user argument to a function call makes your code insecure.

Insecure temporary file or directory

Insecure ways of creating temporary files and directories can lead to race conditions, privilege escalation, and other security vulnerabilities.

Check failed records when using kinesis

A batch request that doesn't check for failed records can lead to loss of data.

AWS api logging disabled cdk

Api Logging Disabled may lead to unable to access log and does not record the event.

Improper Access Control CDK

The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.

Least privilege violation

The elevated privilege level should be dropped immediately after the operation is performed.

File extension validation

Checks if the extension of a file uploaded by a user is validated before the file is saved.

Resource leak

Allocated resources are not released properly.

Set SNS Return Subscription ARN

To always return the subscription ARN, set the ReturnSubscriptionArn argument to True.

Insecure object attribute modification

Updating object attributes obtained from external sources is security sensitive.

Missing Authentication for Critical Function CDK

Missing authentication checks can lead to unauthorized access to a resource or performance of an action.

Typeof expression

The typeof operator should only be compared to valid values.

AWS missing encryption of sensitive data cdk

Sensitive or critical information is not encrypted before storage or transmission in the product.

Unauthenticated Amazon SNS unsubscribe requests might succeed

Failing to set the AuthenticateOnUnsubscribe flag to True when confirming an SNS subscription can lead to unauthenticated cancellations.

Cross-site request forgery

Insecure configuration can lead to a cross-site request forgery (CRSF) vulnerability.

Client-side KMS reencryption

Client-side decryption followed by encryption is inefficient and can lead to sensitive data leaks.

Insecure cryptography

Weak, broken, or misconfigured cryptography can lead to security vulnerabilities.

Deserialization of untrusted object

Deserialization of untrusted objects can lead to security vulnerabilities such as, inadvertently running remote code.

Clear text credentials

Credentials that are stored in clear text can be intercepted by a malicious actor.

Improper handling of case sensitivity

Improper handling of case sensitivity when accessing a resource can lead to inconsistent results.

Unsanitized input is run as code

Scripts generated from unsanitized inputs can lead to malicious behavior and inadvertently running code remotely.

Protection mechanism failure

Disabled or incorrectly used protection mechanism can lead to security vulnerabilities.

Use of a deprecated method

This code uses deprecated methods, which suggests that it has not been recently reviewed or maintained.

Sensitive information leak

Exposure of sensitive information can lead to an unauthorized actor having access to the information.

DNS prefetching

DNS prefetching can cause latency and privacy issues.

Exposure of Sensitive Information CDK

The product unintentionally grants unauthorized actors access to a resource by placing it in the wrong control sphere.

Insecure JWT parsing

Checks if the none algorithm is used in a JWT token parsing.

Loose file permissions

Weak file permissions can lead to privilege escalation.

Missing Authorization CDK

Improper Access Control.

Sensitive query string

Do not fetch sensitive information from a GET request.

Insufficient Logging CDK

In the case of a security-critical event, the product fails to either log the event or misses crucial details in the logged information.

OS command injection

Constructing operating system or shell commands with unsanitized user input can lead to inadvertently running malicious code.

NoSQL injection

User input can be vulnerable to injection attacks.

Unverified hostname

Unverified hostnames lead to security vulnerabilities.

Path traversal

Creating file paths from untrusted input might give a malicious actor access to sensitive files.

Origins-verified cross-origin communications

Unverified origins of messages and identities in cross-origin communications can lead to security vulnerabilities.

LDAP injection

LDAP queries that rely on potentially untrusted inputs can allow attackers to read or modify sensitive data, run code, and perform other unwanted actions.

SNS don't bind subscribe and publish

Do not bind the SNS Publish operation with the SNS Subscribe or Create Topic operation.

S3 partial encrypt CDK

An unencrypted bucket could lead to sensitive data exposure.

Non-literal regular expression

Non-literal input to a regular expression might lead to a denial of service attack.

Stack trace exposure

Stack traces can be hard to use for debugging.

File and directory information exposure

Allowing hidden files while serving files from a given root directory can cause information leakage.

Usage of an API that is not recommended

APIs that are not recommended were found.

Lazy Load Module

Checks for lazy module loading.

Disabled HTML autoescape

Disabling the HTML autoescape mechanism exposes your web applications to attacks.

Improper access control

The software does not restrict or incorrectly restrict access to a resource from an unauthorized actor.

Cross-site scripting

Relying on potentially untrusted user inputs when constructing web application outputs can lead to cross-site scripting vulnerabilities.

Sensitive data stored unencrypted due to partial encryption

Encryption that is dependent on conditional logic, such as an if...then clause, might cause unencrypted sensitive data to be stored.

AWS client not reused in a Lambda function

Recreating AWS clients in each Lambda function invocation is expensive.

URL redirection to untrusted site

User-controlled input that specifies a link to an external site could lead to phishing attacks and allow user credentials to be stolen.

Untrusted data in security decision

Security decisions should not depend on branching that can be influenced by untrusted or client-provided data.